SquadFlow logo
SquadFlow
Manual QA Companion · Chrome Extension

Privacy Policy

How SquadFlow handles your data: everything stays in your browser, under your control.

Last Updated: October 27, 2026
No developer servers
Nothing is sent to us. Ever.
No tracking or analytics
No ads, no selling of data.
Stored locally
Keys and settings stay in your browser profile.
You stay in control
Capture only starts when you choose.

This Privacy Policy describes how the SquadFlow Chrome Extension ("we", "our", "us", or "the extension") handles and protects user data. We are committed to ensuring your privacy and protecting the security of your test data and credentials. We strictly adhere to a policy of no user tracking, no selling of user data, no advertising, and no analytics.

No Developer Servers, No Tracking, and No Advertising: We do not operate developer-owned servers, run analytics, show ads, or track your behavior. All configurations and captured data remain stored locally in your browser under your absolute control, except when you intentionally and directly communicate with your configured AI providers or Jira via secure HTTPS.

1Data We Collect

To perform its functions as a QA helper and test-case generation utility, the extension processes and saves the following types of information:

  • API Keys & Configuration: API keys for AI models (e.g., OpenAI, Anthropic, Gemini, Groq, DeepSeek, etc.) that you configure.
  • Jira Credentials: Your target Jira domain, account email, and Jira API token to allow logging bugs and creating issues directly from the extension.
  • Bug Descriptions & Test Cases: Draft bug reports, test scripts, and scenarios entered or selected by you for AI-powered processing.
  • Browser Recordings & Assets: Screenshots and video recordings you start during your QA testing flow to document bugs. Capture only begins after you choose a browser window or screen in your browser's own sharing picker, and stops when you press Stop or the browser's "Stop sharing" button. Recordings are saved to your computer and are only sent anywhere (e.g. attached to a Jira issue) when you choose to.
  • Session Containers (optional): Only if you turn on Session Containers, the extension saves the cookies of the websites you add to it — and, if you enable it for a site, that site's localStorage — so each test account keeps its own login. This data is stored only in your browser (chrome.storage.local), is never sent to the developer or to any third party, and is deleted when you remove the container or uninstall the extension. SquadFlow's own Jira and AI-provider sites are never included.

2How Data is Stored

We respect the integrity of your local system environment. The extension handles storage according to these principles:

  • Local Storage Only: All configurations, API keys, credentials, and recording metadata are saved locally within the user's browser profile.
  • Chrome Storage API (Local): We utilize the chrome.storage.local API to store configurations and credentials, which ensures data is kept on your machine and is not synced to Google's cloud servers.
  • Session Storage (Temporary): Temporary recording state and active session parameters are stored using the chrome.storage.session API. This data is strictly temporary, kept only in memory, and cleared automatically when the browser session ends or the extension is closed.
  • No Extension Servers: We do not host or operate any backend servers. No data collected by this extension is ever stored, analyzed, or received by us.

3Data Transmission

All communication with external services occurs directly from your browser. There are no developer-owned servers, and no analytics or tracking servers are used. Communication occurs only when you explicitly perform an action (e.g., requesting AI analysis or logging a bug). All network communication is conducted securely over HTTPS.

The extension transmits data ONLY to the following user-configured endpoints depending on the services you enable:

  • Jira Cloud & Test Management Integration:
    • https://*.atlassian.net/* (direct communication with your Jira Cloud instance to manage issues)
    • https://tcms.aiojiraapps.com/* (direct communication to manage test cases via Jira-compatible plugins)
  • User-Configured AI Service Providers:
    • OpenAI (https://api.openai.com/*)
    • Anthropic (https://api.anthropic.com/*)
    • Google Gemini (https://generativelanguage.googleapis.com/*)
    • Groq (https://api.groq.com/*)
    • DeepSeek (https://api.deepseek.com/*)
    • Zhipu GLM (https://open.bigmodel.cn/*)
    • Hugging Face (https://router.huggingface.co/*)
    • OpenRouter (https://openrouter.ai/*)
    • EcomAgent (https://api.ecomagent.in/*)
    • Cerebras (https://api.cerebras.ai/*)
    • SovereignEG (https://backend.sovereigneg.com/*)

These external integrations are entirely configured by the user, and credentials/keys are transmitted directly to the respective endpoints without passing through any third party or developer servers.

Session Containers work entirely inside your browser and do not send any data over the network.

4Required Permissions & Justifications

The extension requests specific browser permissions in manifest.json to perform its testing and automation features. Below are the details and justifications for each key permission:

<all_urls> / Content Scripts

The extension is designed for software testing and may operate on any website selected by the user. Content scripts are injected only when required for QA features, allowing the QA Test Data helper to appear on target websites, inspect inputs, and autofill test data.

downloads

Required to download generated bug recordings, screenshots, and export files directly onto your local machine.

scripting

Required to inject the interactive recording toolbar and page-helper styles into web pages you are actively testing.

storage

Required to save your configured API keys, AI model preferences, Jira credentials, and active recording configurations locally.

activeTab

Required to temporarily access the currently active tab when you trigger extension features via the popup or context menu, enabling target style injections and QA data entry helpers without requesting permanent wide access.

offscreen

Hosts the screenshot and bug-recording session when you start one, and encodes recordings without blocking the background service worker. The browser's own picker asks you which window or screen to share (this is how the DevTools panel can be included); nothing is captured without that choice, and files are saved only to your computer.

notifications

Required to show desktop notifications informing you when a test case generation is complete, a bug report is successfully logged to Jira, or when a recording has finished exporting.

alarms

Required for the built-in Pomodoro focus timer, so it can notify you when a session ends even while the popup is closed. No data is collected or sent.

cookies (optional)

Requested only when you turn on Session Containers (and removed when you turn it off). Used to save and restore the login cookies of the websites you add, so you can switch between test accounts of the same site without logging out. Cookies are kept only in your browser and never sent anywhere.

tabGroups (optional)

Requested only if you choose to group Session Container tabs. Used to colour and label each account's tabs so you can tell them apart. No data is collected or sent.

Site access (optional)

Requested at runtime, never at install. When you select an AI provider that needs it (e.g. SovereignEG, Cerebras, a Custom endpoint), only that provider's address is requested. When you turn on Session Containers, Chrome asks for access to websites together with the cookies permission, because Chrome only lets an extension see the cookies of sites it can access; SquadFlow only reads and writes the cookies of the websites you add to Session Containers. You can remove this access at any time from Chrome's extension settings.

5User Rights & Control

You maintain full ownership and control over your data. You can manage or delete your stored data at any time:

  • Clearing Settings: You can clear your API keys or disconnect Jira credentials at any time directly through the extension's Options page.
  • Session Containers: You can sign out of or delete any container from the Session Containers page, turn the feature off at any time, and revoke the optional cookies / tabGroups permissions from Chrome's extension settings.
  • Complete Erasure: Uninstalling the SquadFlow extension from Chrome immediately and permanently removes all stored data, API keys, and settings from your browser profile.

6Contact Developer

If you have any questions or feedback regarding this Privacy Policy or the security of the SquadFlow Chrome Extension, please contact the developer:

Developer Contact Email
salahqc0@gmail.com
Email the developer